How to Reduce Antimalware Service Executable High CPU Usage

If your computer suddenly feels slow and you notice Antimalware Service Executable using a large amount of CPU in Task Manager, there may be a simple explanation.

Antimalware Service Executable is the Windows process associated with Microsoft Defender Antivirus, Microsoft’s built-in malware protection. It runs in the background to scan files, monitor activity, and protect your PC from threats. During some scans, it can temporarily use a noticeable amount of CPU and disk resources.

That doesn’t necessarily mean something is wrong with Windows or that your computer is infected. In many cases, the process is simply busy performing a scan. The important question is whether the high CPU usage is temporary or keeps happening when your PC isn’t doing much else.

This guide explains why Antimalware Service Executable can use so many resources, what you can safely do to reduce the impact, and when high CPU usage may be a sign that you need to investigate further.

What Is Antimalware Service Executable?

Antimalware Service Executable is the process associated with Microsoft Defender Antivirus. You may see it in Task Manager as:

Antimalware Service Executable

The executable behind the process is commonly associated with MsMpEng.exe.

Microsoft Defender uses this process for security tasks such as scanning files and checking activity for potential threats.

What Does Antimalware Service Executable Do?

Its main responsibilities include:

• Real-time protection: Checks files and activity for potential threats as you use Windows.
• Scheduled scans: Runs malware scans according to Windows Defender’s configured schedule.
• Security updates: Uses updated security intelligence to detect newer threats.
• Threat remediation: Helps quarantine or remove threats detected during scans.

Because these tasks happen in the background, you may occasionally notice higher CPU or disk usage while Defender is working.

High usage for a short period isn’t automatically a problem. The situation is more worth investigating when the process stays unusually active for a long time or repeatedly makes your PC sluggish.

Why Is Antimalware Service Executable Using So Much CPU?

Several things can cause Antimalware Service Executable to use more CPU than usual.

1. Microsoft Defender Is Running a Scan

This is one of the first things to check.

Microsoft Defender can use additional system resources while scanning files, applications, and other parts of your PC. A scan may be more noticeable when you have a large amount of data or many files that need to be examined.

If the CPU spike happens during a scan and drops afterward, that may be normal behavior.

2. You’re Running Resource-Heavy Workloads

Defender doesn’t stop working just because you’re gaming, editing video, downloading large files, or running several applications.

If the CPU is already busy, Defender’s activity can make the overall system feel slower.

In this case, the issue may be a combination of workloads rather than Antimalware Service Executable alone.

3. Another Antivirus Program Is Installed

Running multiple security products can complicate how Windows handles antivirus protection.

If you’ve recently installed another antivirus application, check whether Microsoft Defender has changed its behavior and whether the third-party product is now providing the primary antivirus protection.

Avoid running multiple full antivirus products unnecessarily.

4. Windows or Security Intelligence Updates Are Pending

Microsoft Defender relies on updated security intelligence to detect threats.

If Windows or Defender hasn’t updated recently, check Windows Update and Windows Security before trying more aggressive troubleshooting.

5. A Large Number of Files Are Being Accessed

Some workloads naturally generate a lot of file activity.

Examples include:

• Large software installations
• Extracting archives
• Compiling code
• Copying large directories
• Downloading many files
• Working with large project folders

Defender may inspect files as they are created or accessed, which can increase resource usage temporarily.

6. Another Software or System Problem Is Increasing the Workload

Corrupted system components, software conflicts, or unusually high overall system activity can sometimes make troubleshooting more complicated.

Don’t assume every CPU spike means Defender itself is the root cause.

First determine whether Defender is actively scanning and whether the usage falls back down afterward.

How to Reduce Antimalware Service Executable CPU Usage

Start with the safest and simplest fixes. There’s usually no reason to disable Microsoft Defender immediately.

1. Let the Current Scan Finish

If Defender is actively scanning your computer, give it some time to complete.

You can check the security status in Windows Security:

1. Open Windows Security.
2. Select Virus & threat protection.
3. Look for the current protection or scan status.
4. Check whether a scan is currently running.

If CPU usage returns to normal after the scan finishes, there may not be anything that needs to be changed.

2. Update Windows and Microsoft Defender

Keeping Windows and Defender current can help ensure you’re using the latest security components and security intelligence.

On current versions of Windows:

1. Press Win + I to open Settings.
2. Open Windows Update.
3. Select Check for updates.
4. Install available updates and restart if Windows requests it.
5. Open Windows Security.
6. Go to Virus & threat protection and check for available security intelligence updates.

The exact menu labels can vary between Windows versions.

3. Check What’s Using Your CPU

Before changing Defender settings, confirm that it is actually the process causing the slowdown.

Press:

Ctrl + Shift + Esc

to open Task Manager.

Then:

1. Open the Processes tab.
2. Sort by CPU.
3. Look at Antimalware Service Executable alongside other processes.
4. Check whether CPU usage remains high or only spikes periodically.

This distinction matters.

If Antimalware Service Executable briefly jumps during a scan and then drops, that’s different from a process that remains near the top of the CPU list for hours.

4. Avoid Running Several Heavy Tasks at Once

If Defender is scanning while you’re also performing a CPU-intensive task, your computer may feel significantly slower.

For example, you might notice more impact while:

• Gaming
• Rendering video
• Compiling a large project
• Compressing or extracting files
• Running virtual machines
• Installing large applications

When practical, let scans or heavy file operations run when you’re not doing other demanding work.

5. Review Scheduled Scans

If Defender repeatedly starts scans when you’re working, you can review its scheduled tasks and see whether the timing is contributing to the problem.

To inspect the scheduled tasks:

1. Press Win + R.
2. Type:

taskschd.msc

1. Press Enter.
2. Navigate to:

Task Scheduler Library > Microsoft > Windows > Windows Defender

1. Review the Defender-related tasks.

The exact scheduling behavior is managed by Windows, so avoid changing tasks blindly. If you’re unsure what a task does, leave it at its default configuration.

The goal is to reduce disruption, not disable protection.

Can You Limit How Much CPU Microsoft Defender Uses?

There isn’t a simple Windows Security switch that lets most users assign Microsoft Defender a fixed CPU percentage such as 10% or 20%.

That means you shouldn’t follow guides that promise a simple “CPU limit” setting in Windows Security.

A more practical approach is to:

• Let active scans finish
• Keep Windows and Defender updated
• Avoid stacking several heavy workloads
• Review scheduled tasks when timing is the problem
• Investigate persistent CPU usage instead of trying to force Defender to use a specific percentage

For most users, identifying why Defender is active is more useful than trying to impose an arbitrary CPU limit.

Should You Exclude Files or Folders From Microsoft Defender?

Microsoft Defender allows exclusions for files, folders, file types, and processes.

However, exclusions reduce the areas Defender checks. That means they should be used carefully.

For example, developers sometimes consider exclusions for large source-code or build directories, but adding broad exclusions can weaken protection if malicious files are introduced into those locations.

To review exclusions:

1. Open Windows Security.
2. Select Virus & threat protection.
3. Select Manage settings.
4. Scroll to Exclusions.
5. Select Add or remove exclusions.

You may see options for:

• File
• Folder
• File type
• Process

Only exclude something when you understand why it needs to be excluded and what security coverage you’re giving up.

Avoid adding your entire drive, Downloads folder, or other broad locations simply to reduce CPU usage.

Should You Disable Microsoft Defender Real-Time Protection?

Usually, no.

Turning off real-time protection can reduce Defender activity temporarily, but it also reduces an important layer of protection.

If you disable it for troubleshooting, treat that as a short test rather than a permanent fix.

To access the setting:

1. Open Windows Security.
2. Select Virus & threat protection.
3. Select Manage settings.
4. Find Real-time protection.
5. Change it only when you have a specific reason to test whether it is involved.

Turn protection back on afterward.

It’s generally better to investigate persistent CPU usage than to leave antivirus protection disabled just to make Task Manager look better.

Check for Malware and Software Conflicts

Ironically, one reason to investigate persistent Defender activity is the possibility that something on the system actually needs attention.

Start with Microsoft Defender itself.

Run a Malware Scan

Open Windows Security > Virus & threat protection and choose the available scan options.

A full scan can take a while, especially on systems with a large amount of data.

If you’re dealing with unexplained or persistent behavior, an additional scan from a reputable security product can provide another opinion.

You can use Malwarebytes as an additional malware-detection tool.

Don’t install multiple full-time antivirus products just because you’re troubleshooting. An additional on-demand scan is different from running several real-time security products simultaneously.

Check Whether Microsoft Defender Is Actually the Problem

It’s easy to blame Antimalware Service Executable because it appears near the top of Task Manager.

Before changing anything, look at the bigger picture.

Ask:

• Is CPU usage high only during a scan?
• Does usage fall after the scan completes?
• Is another application also consuming a large amount of CPU?
• Does the slowdown happen only during gaming or another heavy workload?
• Did the problem begin after installing new software?
• Are many files being created, copied, or modified?
• Does the problem happen after restarting Windows?

This can help separate a temporary Defender workload from a broader performance issue.

What About the Windows Defender Reset or Reinstall Method?

Older troubleshooting guides sometimes recommend resetting Windows Defender components with PowerShell commands.

For example, you may see commands such as:

Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage

This is related to resetting the Windows Security user interface package, not simply “reinstalling Microsoft Defender Antivirus.”

Because Windows components and PowerShell behavior can differ between Windows releases, I wouldn’t recommend using this as a first-line fix for high CPU usage.

Try the safer troubleshooting steps first. If Windows Security itself is malfunctioning, use current Microsoft troubleshooting guidance appropriate to your Windows version before running system-level commands.

When Should You Worry About High CPU Usage?

A temporary spike isn’t necessarily concerning.

It’s more worth investigating when:

• Antimalware Service Executable stays unusually high for a long time.
• The CPU usage returns repeatedly without an obvious scan.
• Your PC remains sluggish after scans finish.
• Windows Security reports an unresolved threat.
• Other applications are crashing or behaving strangely.
• You notice unexplained network or disk activity.
• The problem began after installing unfamiliar software.

Look at the evidence rather than using CPU percentage alone as proof that Microsoft Defender is broken.

How to Check Whether a Scan Is Running

You can usually start with Windows Security.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Review the current protection status.
4. Check any scan information shown there.
5. Compare it with Task Manager’s CPU usage.

You can also look at Task Manager to see whether Antimalware Service Executable is currently consuming CPU or disk resources.

If the usage drops once the scan completes, that points toward normal scanning activity rather than a persistent performance problem.

Does High Antimalware Service Executable CPU Usage Mean Your PC Is Infected?

No.

High CPU usage doesn’t automatically mean that Microsoft Defender found malware.

Defender can consume CPU while scanning a healthy system.

At the same time, persistent unexplained activity shouldn’t be ignored. If the behavior keeps returning and you can’t connect it to scans, file activity, updates, or other normal workloads, investigate the system further.

Is It Safe to End Antimalware Service Executable in Task Manager?

It’s not a good long-term solution.

Antimalware Service Executable is part of Microsoft’s security protection, and manually trying to terminate security processes can interfere with protection or simply result in the process starting again.

Instead of repeatedly ending the process, identify why it’s using resources.

Stopping a security process may make the CPU number fall temporarily without actually fixing the underlying problem.

Can Another Antivirus Replace Microsoft Defender?

Yes. Windows can use a compatible third-party antivirus product instead of Microsoft Defender’s primary real-time antivirus protection.

If you choose another antivirus, use a reputable product and make sure you understand how Windows changes its built-in protection when the third-party software becomes the active antivirus.

Avoid running multiple full real-time antivirus products together unless the vendors specifically support that configuration.

Frequently Asked Questions

Why is Antimalware Service Executable using so much CPU?

The process can use more CPU while Microsoft Defender is scanning files or performing other security tasks. Heavy file activity, system load, and software interactions can also make the impact more noticeable.

Can Antimalware Service Executable slow down my PC?

Yes, temporarily. A Defender scan can use CPU and other system resources, which may make Windows feel slower while the scan is running.

Should I disable Antimalware Service Executable?

No, not as a permanent solution. It is part of Microsoft’s built-in malware protection. Investigate the reason for the high usage before disabling security features.

How do I know if Microsoft Defender is scanning?

Open Windows Security > Virus & threat protection and review the current scan or protection status. You can also compare that information with CPU and disk activity in Task Manager.

Can I limit Microsoft Defender’s CPU usage?

Windows doesn’t provide a simple CPU percentage slider for Microsoft Defender in Windows Security. Scheduling and workload management are more practical ways to reduce the impact of scans.

Will excluding a folder reduce Defender CPU usage?

It can reduce scanning activity for that location, but exclusions also reduce protection. Use them only when there is a specific reason, and avoid broad exclusions.

Should I use Malwarebytes with Microsoft Defender?

You can use Malwarebytes as an additional malware-detection tool, but avoid unnecessarily running multiple full-time real-time antivirus products at the same time.

Why does Antimalware Service Executable keep coming back after I end it?

It’s part of Windows’ security protection, so manually ending the process isn’t a reliable fix. Windows or Defender may restart the service because security protection still needs to run.

Does high CPU usage mean Microsoft Defender found a virus?

No. Defender can use significant CPU during a normal scan even when no malware is found.

What should I do if the CPU usage never goes down?

Start by checking whether a scan is active, updating Windows and Defender, and checking which other processes are using CPU. If the problem continues, investigate software conflicts, unusual file activity, and possible malware.

Conclusion

Antimalware Service Executable is a normal Windows security process, and temporary high CPU usage doesn’t automatically mean there’s a problem. Microsoft Defender may use additional resources while scanning your files or responding to other activity on the system.

Start with the simple checks: confirm whether a scan is running, update Windows and security intelligence, and use Task Manager to see whether the CPU usage actually remains high.

If the problem keeps returning, investigate the workload rather than immediately disabling Defender. Review scheduled scans, check for software conflicts, look at unusual file activity, and run a malware scan when there are other signs that something may be wrong.

Be especially careful with exclusions and security-related settings. Reducing CPU usage isn’t a useful trade if it leaves your PC with significantly less protection.

For additional troubleshooting, the Microsoft Support Community can provide Windows-specific guidance, while Microsoft’s Defender documentation provides deeper technical information.

The goal is to keep Microsoft Defender working without allowing a temporary scan to become a permanent performance problem.